Mg CLI

cd modelguide-api
bun run src/cli/mg.ts setup /path/to/my-org/           # provision everything
bun run src/cli/mg.ts setup /path/to/my-org/ --dry-run  # validate and preview without changes

cd modelguide-api
bun run src/cli/mg.ts create-org --from /path/to/org.yaml
bun run src/cli/mg.ts add-users --org acme --from /path/to/users.yaml
bun run src/cli/mg.ts add-secrets --org acme --from /path/to/secrets.yaml
bun run src/cli/mg.ts add-connectors --org acme --from /path/to/connectors.yaml
bun run src/cli/mg.ts add-agents --org acme --from /path/to/agents.yaml
bun run src/cli/mg.ts import-sops --org acme /path/to/sops.yaml
bun run src/cli/mg.ts import-guardrails --org acme /path/to/guardrails.yaml
bun run src/cli/mg.ts import-evals --org acme /path/to/evals.yaml
bun run src/cli/mg.ts compile-agents --org acme
bun run src/cli/mg.ts import-sessions --org acme /path/to/sessions.yaml

1. org.yaml        — organization (everything scoped to this)
2. users.yaml      — users (agents need a createdBy user)
3. secrets.yaml    — standalone secrets (connectors may reference these)
4. connectors.yaml — connectors + connector-scoped secrets
5. agents.yaml     — agents + tool assignments (references connectors)
6. sops.yaml       — SOPs (references agents + connector tools)
7. guardrails.yaml — guardrails (references agents)
8. evals.yaml     — eval suites, evaluators, test cases (references agents + SOPs)
9. compile-agents  — compiles each agent against its active SOPs (skipped with --skip-compile)
10. sessions.yaml  — demo sessions (references agents)

name: "Acme Corp"
slug: "acme"                    # lowercase + hyphens only
timezone: "America/Chicago"     # optional
features: [voice-agents]        # optional
demoEnabled: false              # optional, default false

users:
  - email: admin@acme.example.com
    name: "Alice Admin"
    role: admin                 # admin | support

secrets:
  - name: OpenAI API Key
    type: platform_api_key      # api_key | oauth_token | credentials | platform_api_key | webhook_secret
    scope: agent                # connector | agent (optional)
    # value: omitted = prompted interactively (or placeholder with --skip-secrets)

# Real connector — references a registered TypeScript manifest
connectors:
  - name: "Acme Store"
    slug: "acme_store"          # lowercase + underscores
    catalogSlug: "medusa"       # must match a catalog entry — see references/catalog.md
    config:
      baseUrl: "https://api.acme.example.com"
    secrets:                    # connector-scoped secrets created automatically
      - field: "secretApiKey"    # field name in connector config
        name: "Acme Store API Key"
        type: api_key

  # Mocked connector — DB-driven fixtures, no TypeScript handler (ADR-013)
  - name: "Bank Nowa Banking (Mock)"
    slug: "banknowa_banking"
    isMocked: true              # switches schema branch
    iconUrl: "/logos/bank-nowa.svg"   # optional
    tools:                       # inline tool defs — each returns `mock_response` verbatim
      - name: "Verify Customer"
        description: "Verify identity."
        input_schema:
          type: object
          properties: { name: {type: string} }
          required: [name]
        mock_response:
          success: true
          customer_id: "CUST-001"

agents:
  - name: "Acme Voice Agent"
    slug: "acme-voice-agent"
    description: "Handles phone orders"
    modality: voice             # voice | text (default: voice)
    platform: custom            # custom | elevenlabs | livekit (default: custom)
    tools:
      - connectorSlug: "acme_store"           # all tools from this connector
      - connectorSlug: "acme_support"
        toolSlugs: [create_ticket, get_ticket] # specific tools only

agents:
  - name: "Acme Voice Agent"
    slug: "acme-voice-agent"
    modality: voice
    platform: livekit
    config:
      # Only url + agentName are valid for livekit. llmModel is rejected
      # (baked into the worker image).
      url: "wss://your-project.livekit.cloud"
      agentName: "acme_voice_agent"   # must match the profile key in the worker's config/agents.yaml
    tools:
      - connectorSlug: "acme_store"
    secrets:
      # No `value:` → `mg setup` prompts once per field. These exact field
      # names are read by agents.service.ts:getAgentSecretByType when
      # dispatching the worker.
      - field: livekit_api_key
        name: "LiveKit API Key"
        type: api_key
      - field: livekit_api_secret
        name: "LiveKit API Secret"
        type: api_key